Virus.Win32.Duel_dbec003401

by malwarelabrobot on July 12th, 2013 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Email-Worm.Win32.Brontok!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Email-Worm, Virus, IRCBot


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Technical Details
Removal Recommendations

MD5: dbec0034012913650c2088f221dbc554
SHA1: 92fa8c8e065e02054db5f0425252792f326b2642
SHA256: 11501618985742ff9a93c99cfb18b7726210574390c30accdee62183e704c260
SSDeep: 384:vd6g IKgT/X79Z673HrUrreeF0R8GVG nWbx/kUsvUvzSMMlrdk:vkR2X7DS3HIFsDSxMBa F2
Size: 42496 bytes
File type: PE32
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: no data


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Email-Worm. Worm that spreads its copies in attachments included in emails.
Virus. A program that recursively replicates a possibly evolved copy of itself.
IRCBot. A bot communicates with command and control servers via IRC channel.

Process activity

The Virus creates the following process(es):

abijrazyi.yai:1024
abijrazyi.yai:1996
Reader_sl.exe:1064
wuauclt.exe:344
dbec0034012913650c2088f221dbc554.exe:1480
jusched.exe:1056

File activity

The process abijrazyi.yai:1024 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jiayqz.brza.iyq (42 bytes)

The process abijrazyi.yai:1996 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qiqzzj.qqra.iyq (42 bytes)

The process wuauclt.exe:344 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (3576 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Virus deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

The process dbec0034012913650c2088f221dbc554.exe:1480 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\arrrziiir.rqy (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\rabrrarar.qqj (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jraiba.jrya.iyq (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\zbyjayaya.rab (42 bytes)
%Program Files%\Outlook Express\rabrrarar.qqjarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\zbyjayaya.rab (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\riazzzari.byq (42 bytes)
C:\Perl\bin\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\rabrrarar.qqj (42 bytes)
%WinDir%\ime\imjp8_1\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\riazzzari.byq (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\riazzzari.byq (42 bytes)
%Program Files%\Common Files\Adobe\Updater6\rrzqyjaaa.riz (42 bytes)
%Program Files%\Wireshark\yzbzbyqqj.byj (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\yzbzbyqqj.byj (42 bytes)
%Program Files%\Windows NT\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\abijrazyi.yai (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\yzbzbyqqj.byj (42 bytes)
%Program Files%\NetMeeting\riazzzari.byqrabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\arrrziiir.rqy (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\yzbzbyqqj.byj (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\zbyjayaya.rab (42 bytes)
%WinDir%\$hf_mig$\KB898461\rabrrarar.qqj (42 bytes)
%WinDir%\$NtUninstallKB898461$\spuninst\zbyjayaya.rab (42 bytes)
C:\totalcmd\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\riazzzari.byq (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\rrzqyjaaa.riz (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\rrzqyjaaa.riz (42 bytes)
%Program Files%\Outlook Express\byqyajqia.qjjarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byqyajqia.qjj (42 bytes)
%Program Files%\Outlook Express\abijrazyi.yaiarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\abijrazyi.yai (42 bytes)
%WinDir%\ime\imjp8_1\arrrziiir.rqy (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\rrzqyjaaa.riz (42 bytes)
%WinDir%\pchealth\helpctr\binaries\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\abijrazyi.yai (42 bytes)
%Program Files%\NetMeeting\zbyjayaya.rabrabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\zbyjayaya.rab (42 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\rabrrarar.qqjya.rabyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\rrzqyjaaa.riz (42 bytes)
%Program Files%\Outlook Express\arrrziiir.rqyarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byqyajqia.qjj (42 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\yzbzbyqqj.byj (42 bytes)
%WinDir%\ime\imkr6_1\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\riazzzari.byq (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\zbyjayaya.rab (42 bytes)
%Program Files%\Windows Media Player\riazzzari.byq (42 bytes)
%Program Files%\Windows Media Player\yzbzbyqqj.byjqqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\yzbzbyqqj.byj (42 bytes)
%WinDir%\ime\imjp8_1\yzbzbyqqj.byj (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yzbzbyqqj.byj (42 bytes)
%WinDir%\pchealth\helpctr\binaries\riazzzari.byq (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byqyajqia.qjj (42 bytes)
C:\totalcmd\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\rabrrarar.qqj (42 bytes)
C:\Perl\bin\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\yzbzbyqqj.byj (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rabrrarar.qqj (42 bytes)
C:\totalcmd\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\abijrazyi.yai (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\rabrrarar.qqj (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\rrzqyjaaa.rizi (42 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\yzbzbyqqj.byj (42 bytes)
%Program Files%\WinPcap\arrrziiir.rqyzqyjaaa.riz.yaij (42 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\abijrazyi.yai (42 bytes)
%Program Files%\Windows NT\Pinball\rrzqyjaaa.riz.yaij (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\abijrazyi.yai (42 bytes)
C:\Perl\bin\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byqyajqia.qjj (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\arrrziiir.rqyi (42 bytes)
%Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjji (42 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\rabrrarar.qqj (42 bytes)
%WinDir%\Network Diagnostic\rrzqyjaaa.riz (42 bytes)
%WinDir%\xwrm.exe (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\abijrazyi.yai (42 bytes)
%Program Files%\NetMeeting\yzbzbyqqj.byjrabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\arrrziiir.rqy (42 bytes)
D:\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\rabrrarar.qqj (42 bytes)
%Program Files%\Wireshark\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\riazzzari.byq (42 bytes)
%WinDir%\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\zbyjayaya.rab (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\yzbzbyqqj.byj (42 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byqyajqia.qjj (42 bytes)
%Program Files%\Windows Media Player\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\yzbzbyqqj.byj (42 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\yzbzbyqqj.byj (42 bytes)
%Program Files%\Wireshark\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\rabrrarar.qqj (42 bytes)
%Program Files%\Windows NT\Accessories\abijrazyi.yaij (42 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\zbyjayaya.rab (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\zbyjayaya.rabyqqj.byj (42 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\yzbzbyqqj.byj (42 bytes)
%WinDir%\ime\imjp8_1\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byqyajqia.qjj (42 bytes)
%WinDir%\inf\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\arrrziiir.rqy (42 bytes)
%WinDir%\$hf_mig$\KB898461\update\yzbzbyqqj.byj.yaij (42 bytes)
%WinDir%\Microsoft.NET\Framework\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\rabrrarar.qqj (42 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\rrzqyjaaa.riz (42 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\abijrazyi.yai (42 bytes)
%WinDir%\ime\imjp8_1\riazzzari.byq (42 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\riazzzari.byq (42 bytes)
%WinDir%\ime\imjp8_1\rabrrarar.qqj (42 bytes)
%WinDir%\ime\imjp8_1\zbyjayaya.rab (42 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\abijrazyi.yai (42 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\yzbzbyqqj.byj (42 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\arrrziiir.rqy (42 bytes)
%Program Files%\Wireshark\riazzzari.byq (42 bytes)
%Program Files%\Wireshark\byqyajqia.qjj (42 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\zbyjayaya.rab (42 bytes)
%Program Files%\Wireshark\abijrazyi.yai (42 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\arrrziiir.rqy (42 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byqyajqia.qjj (42 bytes)

The process jusched.exe:1056 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jusched.log (347 bytes)

Registry activity

The process Reader_sl.exe:1064 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process dbec0034012913650c2088f221dbc554.exe:1480 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Network activity (URLs)

A bot communicates with command and control servers via IRC channel.

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Worm that spreads its copies in attachments included in emails.


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    abijrazyi.yai:1024
    abijrazyi.yai:1996
    wuauclt.exe:344
    dbec0034012913650c2088f221dbc554.exe:1480

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Documents and Settings%\%current user%\Local Settings\Temp\jiayqz.brza.iyq (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\qiqzzj.qqra.iyq (42 bytes)
    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (3576 bytes)
    %WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\update\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\yzbzbyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\update\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\update\arrrziiir.rqy (42 bytes)
    %Program Files%\MSN Gaming Zone\Windows\rabrrarar.qqj (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\jraiba.jrya.iyq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\update\zbyjayaya.rab (42 bytes)
    %Program Files%\Outlook Express\rabrrarar.qqjarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0\update\zbyjayaya.rab (42 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\riazzzari.byq (42 bytes)
    C:\Perl\bin\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\rabrrarar.qqj (42 bytes)
    %WinDir%\ime\imjp8_1\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\update\yzbzbyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\riazzzari.byq (42 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\update\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\update\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\update\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\riazzzari.byq (42 bytes)
    %Program Files%\Common Files\Adobe\Updater6\rrzqyjaaa.riz (42 bytes)
    %Program Files%\Wireshark\yzbzbyqqj.byj (42 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\yzbzbyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\yzbzbyqqj.byj (42 bytes)
    %Program Files%\Windows NT\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\update\abijrazyi.yai (42 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\yzbzbyqqj.byj (42 bytes)
    %Program Files%\NetMeeting\riazzzari.byqrabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\arrrziiir.rqy (42 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\yzbzbyqqj.byj (42 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\update\zbyjayaya.rab (42 bytes)
    %WinDir%\$hf_mig$\KB898461\rabrrarar.qqj (42 bytes)
    %WinDir%\$NtUninstallKB898461$\spuninst\zbyjayaya.rab (42 bytes)
    C:\totalcmd\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\update\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\update\riazzzari.byq (42 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\sp3qfe\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\update\yzbzbyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\update\rrzqyjaaa.riz (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\yzbzbyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\update\rrzqyjaaa.riz (42 bytes)
    %Program Files%\Outlook Express\byqyajqia.qjjarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501\byqyajqia.qjj (42 bytes)
    %Program Files%\Outlook Express\abijrazyi.yaiarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\yzbzbyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\update\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\update\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\update\abijrazyi.yai (42 bytes)
    %WinDir%\ime\imjp8_1\arrrziiir.rqy (42 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\rrzqyjaaa.riz (42 bytes)
    %WinDir%\pchealth\helpctr\binaries\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f\update\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba\update\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\update\abijrazyi.yai (42 bytes)
    %Program Files%\NetMeeting\zbyjayaya.rabrabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4\zbyjayaya.rab (42 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\rabrrarar.qqjya.rabyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\update\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\update\rrzqyjaaa.riz (42 bytes)
    %Program Files%\Outlook Express\arrrziiir.rqyarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594\update\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\update\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d\byqyajqia.qjj (42 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\yzbzbyqqj.byj (42 bytes)
    %WinDir%\ime\imkr6_1\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109\update\riazzzari.byq (42 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\zbyjayaya.rab (42 bytes)
    %Program Files%\Windows Media Player\riazzzari.byq (42 bytes)
    %Program Files%\Windows Media Player\yzbzbyqqj.byjqqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\update\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6\yzbzbyqqj.byj (42 bytes)
    %WinDir%\ime\imjp8_1\yzbzbyqqj.byj (42 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\yzbzbyqqj.byj (42 bytes)
    %WinDir%\pchealth\helpctr\binaries\riazzzari.byq (42 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f\update\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\update\byqyajqia.qjj (42 bytes)
    C:\totalcmd\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9\yzbzbyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\rabrrarar.qqj (42 bytes)
    C:\Perl\bin\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795\update\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd\update\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da\yzbzbyqqj.byj (42 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rabrrarar.qqj (42 bytes)
    C:\totalcmd\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0\update\yzbzbyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f\abijrazyi.yai (42 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\update\rabrrarar.qqj (42 bytes)
    %Program Files%\MSN Gaming Zone\Windows\rrzqyjaaa.rizi (42 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260\update\yzbzbyqqj.byj (42 bytes)
    %Program Files%\WinPcap\arrrziiir.rqyzqyjaaa.riz.yaij (42 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\abijrazyi.yai (42 bytes)
    %Program Files%\Windows NT\Pinball\rrzqyjaaa.riz.yaij (42 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\abijrazyi.yai (42 bytes)
    C:\Perl\bin\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\update\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a\update\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8\update\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\update\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\update\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6\byqyajqia.qjj (42 bytes)
    %Program Files%\MSN Gaming Zone\Windows\arrrziiir.rqyi (42 bytes)
    %Program Files%\MSN Gaming Zone\Windows\byqyajqia.qjji (42 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\update\rabrrarar.qqj (42 bytes)
    %WinDir%\Network Diagnostic\rrzqyjaaa.riz (42 bytes)
    %WinDir%\xwrm.exe (42 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5\abijrazyi.yai (42 bytes)
    %Program Files%\NetMeeting\yzbzbyqqj.byjrabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df\arrrziiir.rqy (42 bytes)
    D:\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2\update\rabrrarar.qqj (42 bytes)
    %Program Files%\Wireshark\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\update\riazzzari.byq (42 bytes)
    %WinDir%\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6\update\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154\update\zbyjayaya.rab (42 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50\update\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\yzbzbyqqj.byj (42 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975\update\byqyajqia.qjj (42 bytes)
    %Program Files%\Windows Media Player\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374\update\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be\update\yzbzbyqqj.byj (42 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\yzbzbyqqj.byj (42 bytes)
    %Program Files%\Wireshark\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80\update\rabrrarar.qqj (42 bytes)
    %Program Files%\Windows NT\Accessories\abijrazyi.yaij (42 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c\zbyjayaya.rab (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\zbyjayaya.rabyqqj.byj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729\sp3qfe\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59\update\yzbzbyqqj.byj (42 bytes)
    %WinDir%\ime\imjp8_1\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\byqyajqia.qjj (42 bytes)
    %WinDir%\inf\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\arrrziiir.rqy (42 bytes)
    %WinDir%\$hf_mig$\KB898461\update\yzbzbyqqj.byj.yaij (42 bytes)
    %WinDir%\Microsoft.NET\Framework\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c\rabrrarar.qqj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\rrzqyjaaa.riz (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\abijrazyi.yai (42 bytes)
    %WinDir%\ime\imjp8_1\riazzzari.byq (42 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee\update\riazzzari.byq (42 bytes)
    %WinDir%\ime\imjp8_1\rabrrarar.qqj (42 bytes)
    %WinDir%\ime\imjp8_1\zbyjayaya.rab (42 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2\update\abijrazyi.yai (42 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce\update\yzbzbyqqj.byj (42 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\arrrziiir.rqy (42 bytes)
    %Program Files%\Wireshark\riazzzari.byq (42 bytes)
    %Program Files%\Wireshark\byqyajqia.qjj (42 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc\SP2QFE\zbyjayaya.rab (42 bytes)
    %Program Files%\Wireshark\abijrazyi.yai (42 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074\update\arrrziiir.rqy (42 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e\update\byqyajqia.qjj (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\jusched.log (347 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.